Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
156475707b5862c58f037160f3b04366_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
156475707b5862c58f037160f3b04366_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
156475707b5862c58f037160f3b04366_JaffaCakes118.exe
-
Size
32KB
-
MD5
156475707b5862c58f037160f3b04366
-
SHA1
687f609af57067f005d3df4b54eea478943e92b5
-
SHA256
64d5e96a5283c734f8ed1f7f06e066b8dcf8325538d5ba8ecf26d1783874d18c
-
SHA512
1a2e6a87888b819367af3ba617a83cfbac38d7d675a39f7189acca3f0205f028d9c53e827c810d94a752f6dec7e8fb4746a5f795637b797322df0d6e3f459e7b
-
SSDEEP
384:+9NQq9F6wEvq2wJVtE09EBg77Eim3PbQEehS1lpio7:+rQqT/EvqFLtEUoim3Pb3Ay
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2880 winlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\winlogon.exe 156475707b5862c58f037160f3b04366_JaffaCakes118.exe File opened for modification C:\Windows\winlogon.exe 156475707b5862c58f037160f3b04366_JaffaCakes118.exe File created C:\Windows\winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe 2880 winlogon.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1708 156475707b5862c58f037160f3b04366_JaffaCakes118.exe 1708 156475707b5862c58f037160f3b04366_JaffaCakes118.exe 2880 winlogon.exe 2880 winlogon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2880 1708 156475707b5862c58f037160f3b04366_JaffaCakes118.exe 28 PID 1708 wrote to memory of 2880 1708 156475707b5862c58f037160f3b04366_JaffaCakes118.exe 28 PID 1708 wrote to memory of 2880 1708 156475707b5862c58f037160f3b04366_JaffaCakes118.exe 28 PID 1708 wrote to memory of 2880 1708 156475707b5862c58f037160f3b04366_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\156475707b5862c58f037160f3b04366_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\156475707b5862c58f037160f3b04366_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2880
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5156475707b5862c58f037160f3b04366
SHA1687f609af57067f005d3df4b54eea478943e92b5
SHA25664d5e96a5283c734f8ed1f7f06e066b8dcf8325538d5ba8ecf26d1783874d18c
SHA5121a2e6a87888b819367af3ba617a83cfbac38d7d675a39f7189acca3f0205f028d9c53e827c810d94a752f6dec7e8fb4746a5f795637b797322df0d6e3f459e7b